The field of deep packet inspection involves, among other things, various different possible methods of discovering and analyzing the contents of packetized data being transmitted over a network. Packetized network data may be captured, stored in a packet capture repository and indexed in a database by content analysis and inspection of various network characteristics. Subsequently, artifacts may be extracted from the stored network packet data by identifying and aggregating the payloads of the identified network packet data. Such artifacts may include various files such as images, word processing documents, spreadsheets, video files, emails, instant messages, audio files, presentations, executables, and/or other files that were previously transmitted over the network in packetized form.
Analysis of network packet data stored in the packet capture repository utilizing the indexed database may not provide enough information for full forensic analysis. Traffic information may indicate that a file was transferred, but may not yield certain information about the contents of that file. Extraction of artifacts from the network packet data stored in the packet capture repository may provide additional information for network forensics. However, even extraction of an individual artifact may not provide sufficient information regarding the larger context in which the individual artifact was transmitted across the network in packetized form.